Bug: Order spend panic [ETH]

[drwasho]

Context

• I created a purchase flow to test buying a listing with a very low price that is purchased with a high quantity (listing is below)
• The order got stuck at AWAITING_PAYMENT due to a problem in the POST /ob/orderspend call
  • This problem returned a 200 OK but an empty response... so the problem wasn't handled properly, on top of whatever the problem is

The Problem

To reproduce the problem locally, you'll need to:

1. Download the latest collection from https://github.com/OpenBazaar/eth-postman
2. Create a new listing type I made:

3. Run the new test I made, Complete moderated online (eth, +options, +shipping, +taxes, +coupons, q=10000000000):

This is the order flow of the test:

---

This is the listing:

{
    "listing": {
        "slug": "physical-eth-options-extras-hiquant",
        "vendorID": {
            "peerID": "QmRGCvxohRX7NtAHJ2vziW6DTitCDJxSsJ3QG7GsJeLgpi",
            "handle": "",
            "pubkeys": {
                "identity": "CAESIIGUD8yv0SatWnhIJfmwu+a+BLVJUwH9Ogd24o1IIqh+",
                "bitcoin": "A9P3boODWa2rCqxS4GUsV7L/2g3Q1SAXtfYprfFWacTi"
            },
            "bitcoinSig": "MEUCIQDhQYRHTwaAb0NrCg59Dme7TBeQTeB+lkyaflV95OOD4QIgPdW++LHapAwciVXWHX6wSlbmCNuczuYAqHv/Dy15c2k="
        },
        "metadata": {
            "version": 5,
            "contractType": "PHYSICAL_GOOD",
            "format": "FIXED_PRICE",
            "expiry": "2037-12-31T05:00:00.000Z",
            "acceptedCurrencies": [
                "TBTC",
                "TBCH",
                "TLTC",
                "TZEC",
                "TETH"
            ],
            "pricingCurrency": "",
            "language": "",
            "escrowTimeoutHours": 1,
            "coinType": "",
            "coinDivisibility": 0,
            "priceModifier": 0
        },
        "item": {
            "title": "Physical, ETH, options, extras",
            "description": "This is a listing example for testing orders.",
            "processingTime": "3 days",
            "price": 0,
            "nsfw": false,
            "tags": [
                "vintage dress"
            ],
            "images": [{
                "filename": "front",
                "original": "QmNexx7SaJCVCjyGGG3j2k7fenn3iVhtWdm9RvKvT7GTLq",
                "large": "QmfTKL3Z67mWKTKf9XKSCj1ptmDRaZLr5yjPS4JrVDgo5h",
                "medium": "QmTJfeeapZwFM8EoZAuf16JsSJyxZtKaAR6hmWiMf4CTcF",
                "small": "QmVsoT9iabv6GZhxhvtjSpQMJA6QyMivGTs6MmHJr6TBm9",
                "tiny": "QmbjyAxYee4y3443kAMLcmRVwggZsRDKiyXnXus1qdJJWz"
            }, {
                "filename": "cream",
                "original": "QmTEUnCjuQPj1ggj5UL5vJujkgBiNYY4jkteugnogiCJny",
                "large": "QmNsFdsX2LNALG2WBxw6E6FTPZWgJcRAcLHnKdWczrCNf9",
                "medium": "QmQaSzaoHzp8raZLtPEFyCjTnwfXvDGKdXFM83STDVWG43",
                "small": "QmP3BVFuga7N4XEX8iU2MFYC7pc6mfTRQRrpZbKiVy2Csr",
                "tiny": "QmU1cBgjyHpuzDYbEd4iDVuPzxgKM3CqhRhDJqkHWCKBXq"
            }, {
                "filename": "black",
                "original": "QmZsZ78FJwt281gfeUvGzDnsBW7WNjPWW3aJWDKskhpCRr",
                "large": "QmXixGseetihe6vZiWcTw9N1pieok1YtRoxwvyd5d7jz6s",
                "medium": "QmZydpAJoLsJWbP5vmh59W6bW1kuiCV34yD62hq28AtP7b",
                "small": "QmcADxUo89ZsEAWiYsuUk7hrgjWDMKXL1CtoA9sTNrQFFP",
                "tiny": "QmdA3Nmc8VnwSvt98Deo2RQztEiCsAkNLhron73bnBzARe"
            }, {
                "filename": "other_red",
                "original": "QmZpgjK4jXmdqPg8Jt9YHGVmiuowVve3sbN2AZx7GXioDF",
                "large": "QmbSQZNAL3pZspUYWm6WNBD1oEQ6i9EnWPEsnk1DfdKnAv",
                "medium": "QmcD4pkp7SwCmN95pFnED2hz1LfsoYTPpynxeZbxCMoYPL",
                "small": "QmRdYph9YrfpdzMsaDnuySj6U4AY9dZhmjd8Cv2e6SscUG",
                "tiny": "QmbRFtxNWqACak1vvMJrrxUjzWjTJbMqi3vdUK5ZYvibgt"
            }],
            "categories": [
                "👚 Apparel & Accessories"
            ],
            "grams": 0,
            "condition": "New",
            "options": [{
                "name": "Color",
                "description": "Color of the dress.",
                "variants": [{
                    "name": "Red",
                    "image": {
                        "filename": "front",
                        "original": "QmNexx7SaJCVCjyGGG3j2k7fenn3iVhtWdm9RvKvT7GTLq",
                        "large": "QmfTKL3Z67mWKTKf9XKSCj1ptmDRaZLr5yjPS4JrVDgo5h",
                        "medium": "QmTJfeeapZwFM8EoZAuf16JsSJyxZtKaAR6hmWiMf4CTcF",
                        "small": "QmVsoT9iabv6GZhxhvtjSpQMJA6QyMivGTs6MmHJr6TBm9",
                        "tiny": "QmbjyAxYee4y3443kAMLcmRVwggZsRDKiyXnXus1qdJJWz"
                    }
                }, {
                    "name": "Cream",
                    "image": {
                        "filename": "cream",
                        "original": "QmTEUnCjuQPj1ggj5UL5vJujkgBiNYY4jkteugnogiCJny",
                        "large": "QmNsFdsX2LNALG2WBxw6E6FTPZWgJcRAcLHnKdWczrCNf9",
                        "medium": "QmQaSzaoHzp8raZLtPEFyCjTnwfXvDGKdXFM83STDVWG43",
                        "small": "QmP3BVFuga7N4XEX8iU2MFYC7pc6mfTRQRrpZbKiVy2Csr",
                        "tiny": "QmU1cBgjyHpuzDYbEd4iDVuPzxgKM3CqhRhDJqkHWCKBXq"
                    }
                }, {
                    "name": "Black",
                    "image": {
                        "filename": "black",
                        "original": "QmZsZ78FJwt281gfeUvGzDnsBW7WNjPWW3aJWDKskhpCRr",
                        "large": "QmXixGseetihe6vZiWcTw9N1pieok1YtRoxwvyd5d7jz6s",
                        "medium": "QmZydpAJoLsJWbP5vmh59W6bW1kuiCV34yD62hq28AtP7b",
                        "small": "QmcADxUo89ZsEAWiYsuUk7hrgjWDMKXL1CtoA9sTNrQFFP",
                        "tiny": "QmdA3Nmc8VnwSvt98Deo2RQztEiCsAkNLhron73bnBzARe"
                    }
                }]
            }, {
                "name": "Sizes",
                "description": "Size of the dress.",
                "variants": [{
                    "name": "Small"
                }, {
                    "name": "Medium"
                }, {
                    "name": "Large"
                }, {
                    "name": "Extra Large"
                }]
            }],
            "skus": [{
                "variantCombo": [
                    0,
                    0
                ],
                "productID": "dress-red-small",
                "surcharge": 0,
                "quantity": 0,
                "bigSurcharge": "0",
                "bigQuantity": "0"
            }, {
                "variantCombo": [
                    0,
                    1
                ],
                "productID": "dress-red-medium",
                "surcharge": 0,
                "quantity": 0,
                "bigSurcharge": "45000000000000",
                "bigQuantity": "0"
            }, {
                "variantCombo": [
                    0,
                    2
                ],
                "productID": "dress-red-large",
                "surcharge": 0,
                "quantity": 0,
                "bigSurcharge": "450000000000000",
                "bigQuantity": "0"
            }, {
                "variantCombo": [
                    0,
                    3
                ],
                "productID": "dress-red-xlarge",
                "surcharge": 0,
                "quantity": 0,
                "bigSurcharge": "450000000000000",
                "bigQuantity": "0"
            }, {
                "variantCombo": [
                    1,
                    0
                ],
                "productID": "dress-cream-small",
                "surcharge": 0,
                "quantity": 0,
                "bigSurcharge": "450000000000000",
                "bigQuantity": "0"
            }, {
                "variantCombo": [
                    1,
                    1
                ],
                "productID": "dress-cream-medium",
                "surcharge": 0,
                "quantity": 0,
                "bigSurcharge": "450000000000000",
                "bigQuantity": "0"
            }, {
                "variantCombo": [
                    1,
                    2
                ],
                "productID": "dress-cream-large",
                "surcharge": 0,
                "quantity": 0,
                "bigSurcharge": "450000000000000",
                "bigQuantity": "0"
            }, {
                "variantCombo": [
                    1,
                    3
                ],
                "productID": "dress-cream-xlarge",
                "surcharge": 0,
                "quantity": 0,
                "bigSurcharge": "450000000000000",
                "bigQuantity": "0"
            }, {
                "variantCombo": [
                    2,
                    0
                ],
                "productID": "dress-black-small",
                "surcharge": 0,
                "quantity": 0,
                "bigSurcharge": "450000000000000",
                "bigQuantity": "0"
            }, {
                "variantCombo": [
                    2,
                    1
                ],
                "productID": "dress-black-medium",
                "surcharge": 0,
                "quantity": 0,
                "bigSurcharge": "450000000000000",
                "bigQuantity": "0"
            }, {
                "variantCombo": [
                    2,
                    2
                ],
                "productID": "dress-black-large",
                "surcharge": 0,
                "quantity": 0,
                "bigSurcharge": "450000000000000",
                "bigQuantity": "0"
            }, {
                "variantCombo": [
                    2,
                    3
                ],
                "productID": "dress-black-xlarge",
                "surcharge": 0,
                "quantity": 0,
                "bigSurcharge": "450000000000000",
                "bigQuantity": "0"
            }],
            "priceModifier": 0,
            "bigPrice": "450000",
            "priceCurrency": {
                "code": "TETH",
                "divisibility": 18
            }
        },
        "shippingOptions": [{
            "name": "Worldwide",
            "type": "FIXED_PRICE",
            "regions": [
                "ALL"
            ],
            "services": [{
                "name": "Standard",
                "price": 0,
                "estimatedDelivery": "3 days",
                "additionalItemPrice": 0,
                "bigPrice": "0",
                "bigAdditionalItemPrice": "0"
            }, {
                "name": "Express",
                "price": 0,
                "estimatedDelivery": "3 days",
                "additionalItemPrice": 0,
                "bigPrice": "450000000000000",
                "bigAdditionalItemPrice": "1"
            }]
        }],
        "taxes": [{
            "taxType": "Sales tax",
            "taxRegions": [
                "AUSTRIA"
            ],
            "taxShipping": true,
            "percentage": 1
        }],
        "coupons": [{
            "title": "DASCOUPONPERC",
            "hash": "QmT1BeeCqZe6FzCKYmhaDzUp2DPefzHeeLfF8sj3Vqnia4",
            "percentDiscount": 1,
            "priceDiscount": 0,
            "bigPriceDiscount": ""
        }],
        "moderators": [
            "QmcdkKM2fWCKzTZdpjEY6abzRbDhRRJvNmqwNKVyiDtGky"
        ],
        "termsAndConditions": "These are my terms and conditions.",
        "refundPolicy": "This is my refund policy."
    },
    "hash": "QmRThc5zcK3oNMg8YphZqYC1VAQ46hVBZvn1swCWeSBV6T",
    "signature": "6QdzSiaR4zZPre7vHEjJjmYeNwJVy2CtSdnEcw30u/qwdVumOiaYQD6rt/vWlUn6yJ72YA1WmPTw1Zz06PBMDw=="
}

---

This is the purchase order payload:

{
    "shipTo": "Elwood Blues",
    "address": "1060 W Addison",
    "city": "Chicago",
    "state": "Illinois",
    "countryCode": "AUSTRIA",
    "postalCode": "60613",
    "addressNotes": "",
    "items": [
        {
            "listingHash": "QmRThc5zcK3oNMg8YphZqYC1VAQ46hVBZvn1swCWeSBV6T",
            "bigQuantity": "10000000000",
            "options": [
                {
                    "name": "Sizes",
                    "value": "Large"
                },
                {
                    "name": "Color",
                    "value": "Red"
                }
            ],
            "shipping": {
                "name": "Worldwide",
                "service": "Express"
            },
            "memo": "thanks!",
            "coupons": [
                "LETMEIN"
            ]
        }
    ],
    "moderator": "QmcdkKM2fWCKzTZdpjEY6abzRbDhRRJvNmqwNKVyiDtGky",
    "paymentCoin": "TETH"
}

This is the purchase order response:

{
    "amount": {
        "amount": "4499550004954059999999999",
        "currency": {
            "code": "TETH",
            "currencyType": "crypto",
            "divisibility": 18,
            "name": "Testnet Ethereum"
        }
    },
    "orderId": "QmRGWbhcRcdQpk72A4toN56bfe2P6KPApNtdWbDGdsWZrB",
    "paymentAddress": "0xbB84229770E6Fb560bb531C559e4700fdf228B47",
    "vendorOnline": true
}

---

This is the order spend (POST /ob/orderspend) payload:

{
    "currencyCode": "TETH",
    "address": "0xbB84229770E6Fb560bb531C559e4700fdf228B47",
    "amount": "4499550004954059999999999",
    "feeLevel": "NORMAL",
    "requireAssociateOrder": true,
    "orderID": "QmRGWbhcRcdQpk72A4toN56bfe2P6KPApNtdWbDGdsWZrB"
}

The response was:

At the same time, this appeared in stdout:

goroutine 77424 [running]:
runtime/debug.Stack(0x4a3bc1b, 0xc000295410, 0x1)
        /usr/local/go/src/runtime/debug/stack.go:24 +0xa7
runtime/debug.PrintStack()
        /usr/local/go/src/runtime/debug/stack.go:16 +0x22
github.com/OpenBazaar/openbazaar-go/api.(*jsonAPIHandler).ServeHTTP.func1()
        /Users/drwasho/Work/go/src/github.com/OpenBazaar/openbazaar-go/api/jsonapi.go:176 +0x10b
panic(0x533bc20, 0x6939f10)
        /usr/local/go/src/runtime/panic.go:513 +0x1b9
github.com/OpenBazaar/openbazaar-go/vendor/github.com/ethereum/go-ethereum/core/types.(*Transaction).Hash(0x0, 0x0, 0x0, 0x0, 0x0)
        /Users/drwasho/Work/go/src/github.com/OpenBazaar/openbazaar-go/vendor/github.com/ethereum/go-ethereum/core/types/transaction.go:195 +0x4a
github.com/OpenBazaar/openbazaar-go/vendor/github.com/OpenBazaar/go-ethwallet/wallet.(*EthereumWallet).callAddTransaction(0xc0003261c0, 0x425d3540b7b96a42, 0xc82fe2ba1a3a42c6, 0x2ce8cbec6, 0xb290965300000001, 0xaf11dac07627a5c1, 0x71998ada947680a0, 0x5b58fb5ab9adae07, 0x8543f084f27d8414, 0xa97385738c3a6d0, ...)
        /Users/drwasho/Work/go/src/github.com/OpenBazaar/openbazaar-go/vendor/github.com/OpenBazaar/go-ethwallet/wallet/wallet.go:956 +0x5db
github.com/OpenBazaar/openbazaar-go/vendor/github.com/OpenBazaar/go-ethwallet/wallet.(*EthereumWallet).Spend(0xc0003261c0, 0x0, 0xc002e17890, 0x2, 0x5, 0x5a17f40, 0xc0014cdc40, 0x1, 0xc002e17860, 0x2e, ...)
        /Users/drwasho/Work/go/src/github.com/OpenBazaar/openbazaar-go/vendor/github.com/OpenBazaar/go-ethwallet/wallet/wallet.go:697 +0x6a2
github.com/OpenBazaar/openbazaar-go/core.(*OpenBazaarNode).Spend(0xc0005acea0, 0xc00443e480, 0xc00443e480, 0x0, 0x0)
        /Users/drwasho/Work/go/src/github.com/OpenBazaar/openbazaar-go/core/spend.go:104 +0x4aa
github.com/OpenBazaar/openbazaar-go/api.(*jsonAPIHandler).POSTSpendCoinsForOrder(0xc001ade100, 0x5a14100, 0xc000ce22a0, 0xc0002d0b00)
        /Users/drwasho/Work/go/src/github.com/OpenBazaar/openbazaar-go/api/jsonapi.go:813 +0x12c
github.com/OpenBazaar/openbazaar-go/api.(*jsonAPIHandler).POSTSpendCoinsForOrder-fm(0x5a14100, 0xc000ce22a0, 0xc0002d0b00)
        /Users/drwasho/Work/go/src/github.com/OpenBazaar/openbazaar-go/api/endpoints.go:57 +0x48
github.com/OpenBazaar/openbazaar-go/api.blockingStartupMiddleware(0xc001ade100, 0x5a14100, 0xc000ce22a0, 0xc0002d0b00, 0xc002be9a88)
        /Users/drwasho/Work/go/src/github.com/OpenBazaar/openbazaar-go/api/endpoints.go:270 +0x62
github.com/OpenBazaar/openbazaar-go/api.post(0xc001ade100, 0xc0018b7f30, 0xe, 0x5a14100, 0xc000ce22a0, 0xc0002d0b00)
        /Users/drwasho/Work/go/src/github.com/OpenBazaar/openbazaar-go/api/endpoints.go:57 +0x137a
github.com/OpenBazaar/openbazaar-go/api.(*jsonAPIHandler).ServeHTTP(0xc001ade100, 0x5a14100, 0xc000ce22a0, 0xc0002d0b00)
        /Users/drwasho/Work/go/src/github.com/OpenBazaar/openbazaar-go/api/jsonapi.go:185 +0x8a3
net/http.(*ServeMux).ServeHTTP(0xc0011a0e40, 0x5a14100, 0xc000ce22a0, 0xc0002d0b00)
        /usr/local/go/src/net/http/server.go:2361 +0x127
net/http.serverHandler.ServeHTTP(0xc0017841a0, 0x5a14100, 0xc000ce22a0, 0xc0002d0b00)
        /usr/local/go/src/net/http/server.go:2741 +0xab
net/http.(*conn).serve(0xc0012c3900, 0x5a15c00, 0xc003e32040)
        /usr/local/go/src/net/http/server.go:1847 +0x646
created by net/http.(*Server).Serve
        /usr/local/go/src/net/http/server.go:2851 +0x2f5

[drwasho]

It's clear after reviewing the data that the purchase order used an item and shipping option that charged a few cents for every unit (and there are 10000000000 units), which returned an expected price of ~$1 billion dollars lol.

The POST /ob/orderspend call failed because we didn't have enough funds, but critically it did not fail in the right way. This should have returned a 500 error with a meaningful response to explain there was insufficient funds, not a 200 OK code with an empty response.

UPDATE: Using the correct purchase order payload, the test passed.

• This issue will remain open until failed POST /ob/orderspend calls are handled correctly.

[drwasho]

Ran into this panic again after attempting to fetch an order 2 seconds after releasing the funds from escrow:

2020-03-10 21:29:12.525 [DEBUG] [WalletService/syncUtxos] downloaded 0 Bitcoin utxos
goroutine 55464 [running]:
runtime/debug.Stack(0x4a3ae9b, 0xc0007f1920, 0x1)
        /usr/local/go/src/runtime/debug/stack.go:24 +0xa7
runtime/debug.PrintStack()
        /usr/local/go/src/runtime/debug/stack.go:16 +0x22
github.com/OpenBazaar/openbazaar-go/api.(*jsonAPIHandler).ServeHTTP.func1()
        /Users/drwasho/Work/go/src/github.com/OpenBazaar/openbazaar-go/api/jsonapi.go:176 +0x10b
panic(0x534e8a0, 0xc0033bbda0)
        /usr/local/go/src/runtime/panic.go:513 +0x1b9
github.com/OpenBazaar/openbazaar-go/vendor/github.com/OpenBazaar/go-ethwallet/wallet.(*EthereumWallet).GetConfirmations(0xc00127c540, 0xb044bb4e5e96fa07, 0x96214802dc6f6663, 0x79b6e5aa5df1edb4, 0xe241263cf1e51523, 0x0, 0x0, 0x0)
        /Users/drwasho/Work/go/src/github.com/OpenBazaar/openbazaar-go/vendor/github.com/OpenBazaar/go-ethwallet/wallet/wallet.go:1451 +0x7a1
github.com/OpenBazaar/openbazaar-go/core.(*OpenBazaarNode).BuildTransactionRecords(0xc001228ea0, 0xc000c1c000, 0xc0015d2380, 0x3, 0x4, 0xc00000000c, 0x3, 0x4, 0x0, 0xc0022dc5c0, ...)
        /Users/drwasho/Work/go/src/github.com/OpenBazaar/openbazaar-go/core/utils.go:55 +0x374
github.com/OpenBazaar/openbazaar-go/core.(*OpenBazaarNode).GetOrder(0xc001228ea0, 0xc00295650e, 0x2e, 0xa, 0xc00295650e, 0x2e)
        /Users/drwasho/Work/go/src/github.com/OpenBazaar/openbazaar-go/core/order.go:92 +0x4fb
github.com/OpenBazaar/openbazaar-go/api.(*jsonAPIHandler).GETOrder(0xc0002ac700, 0x5a14da0, 0xc0015c6540, 0xc0024aee00)
        /Users/drwasho/Work/go/src/github.com/OpenBazaar/openbazaar-go/api/jsonapi.go:1725 +0x6c
github.com/OpenBazaar/openbazaar-go/api.get(0xc0002ac700, 0xc00332ebc0, 0x38, 0x5a14da0, 0xc0015c6540, 0xc0024aee00)
        /Users/drwasho/Work/go/src/github.com/OpenBazaar/openbazaar-go/api/endpoints.go:165 +0xcc3
github.com/OpenBazaar/openbazaar-go/api.(*jsonAPIHandler).ServeHTTP(0xc0002ac700, 0x5a14da0, 0xc0015c6540, 0xc0024aee00)
        /Users/drwasho/Work/go/src/github.com/OpenBazaar/openbazaar-go/api/jsonapi.go:183 +0x766
net/http.(*ServeMux).ServeHTTP(0xc001d81620, 0x5a14da0, 0xc0015c6540, 0xc0024aee00)
        /usr/local/go/src/net/http/server.go:2361 +0x127
net/http.serverHandler.ServeHTTP(0xc0005ce9c0, 0x5a14da0, 0xc0015c6540, 0xc0024aee00)
        /usr/local/go/src/net/http/server.go:2741 +0xab
net/http.(*conn).serve(0xc002176f00, 0x5a168a0, 0xc00085a380)
        /usr/local/go/src/net/http/server.go:1847 +0x646
created by net/http.(*Server).Serve
        /usr/local/go/src/net/http/server.go:2851 +0x2f5